CWE-77 · Command Injection (page 37)
Page 37 of 38 — CVEs classified under CWE-77, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-8988 | High | 8.8 | 2017-03-14 | Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows aut… |
CVE-2017-5675 | High | 8.8 | 2017-03-13 | A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera… |
CVE-2016-10194 | Critical | 9.8 | 2017-03-03 | The festivaltts4r gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the (1) to_speech or (2) to_mp3 me… |
CVE-2014-4677 | High | 7.8 | 2017-02-22 | The installPackage function in the installerHelper subcomponent in Libmacgpg in GPG Suite before 2015.06 allows local users to execute arbitrary commands with… |
CVE-2016-9684 | Critical | 9.8 | 2017-02-22 | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface… |
CVE-2016-9683 | Critical | 9.8 | 2017-02-22 | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface… |
CVE-2016-9682 | Critical | 9.8 | 2017-02-22 | The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interf… |
CVE-2016-9337 | Medium | 6.8 | 2017-02-13 | An issue was discovered in Tesla Motors Model S automobile, all firmware versions before version 7.1 (2.36.31) with web browser functionality enabled. The vehi… |
CVE-2015-6024 | Critical | 9.8 | 2017-02-09 | ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote authenticated users to execute arbitr… |
CVE-2016-10098 | Critical | 9.8 | 2017-02-05 | An issue was discovered on SendQuick Entera and Avera devices before 2HF16. Multiple Command Injection vulnerabilities allow attackers to execute arbitrary sys… |
CVE-2016-9873 | Medium | 6.3 | 2017-02-03 | EMC Documentum D2 version 4.5 and EMC Documentum D2 version 4.6 has a DQL Injection Vulnerability that could potentially be exploited by malicious users to com… |
CVE-2016-6649 | Medium | 6.7 | 2017-02-03 | EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by multiple command injection vulnerabiliti… |
CVE-2016-0396 | High | 8.1 | 2017-02-01 | IBM Tivoli Endpoint Manager could allow a user under special circumstances to inject commands that would be executed with unnecessary higher privileges than ex… |
CVE-2016-6270 | High | 8.8 | 2017-01-30 | The handle_certificate function in /vmi/manager/engine/management/commands/apns_worker.py in Trend Micro Virtual Mobile Infrastructure before 5.1 allows remote… |
CVE-2016-10182 | Critical | 9.8 | 2017-01-30 | An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters. |
CVE-2016-9554 | High | 7.2 | 2017-01-28 | The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrati… |
CVE-2016-9553 | High | 7.2 | 2017-01-28 | The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vuln… |
CVE-2015-8971 | High | 7.8 | 2017-01-23 | Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are written to the terminal… |
CVE-2015-3441 | High | 8.8 | 2017-01-05 | The Parental Control panel in Genexis devices with DRGOS before 1.14.1 allows remote authenticated users to execute arbitrary CLI commands via the (1) start_ho… |
CVE-2016-7399 | Critical | 9.8 | 2017-01-04 | scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow remote attackers to ex… |
CVE-2016-10108 | Critical | 9.8 | 2017-01-03 | Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter… |
CVE-2016-10107 | Critical | 9.8 | 2017-01-03 | Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via a modified Cookie header. |
CVE-2016-10074 | Critical | 9.8 | 2016-12-30 | The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command a… |
CVE-2016-10045 | Critical | 9.8 | 2016-12-30 | The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary co… |
CVE-2016-10034 | Critical | 9.8 | 2016-12-30 | The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 m… |
CVE-2016-6656 | High | 7.2 | 2016-12-16 | An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby arbitrary commands… |
CVE-2016-1000156 | Critical | 9.8 | 2016-12-14 | Mailcwp remote file upload vulnerability incomplete fix v1.100 |
CVE-2016-6609 | High | 8.8 | 2016-12-11 | An issue was discovered in phpMyAdmin. A specially crafted database name could be used to run arbitrary PHP commands through the array export feature. All 4.6… |
CVE-2016-9835 | Critical | 9.8 | 2016-12-05 | Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP o… |
CVE-2015-8969 | Critical | 9.8 | 2016-11-03 | git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that… |
CVE-2015-8968 | High | 8.8 | 2016-11-03 | git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repos… |
CVE-2016-0328 | High | 7.8 | 2016-10-22 | IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows local users to obtain ad… |
CVE-2016-0326 | High | 8.8 | 2016-10-22 | IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.x before 4.0.7 iFix11, 5.x before 5.0.2 iFix17, and… |
CVE-2016-0236 | High | 8.8 | 2016-10-21 | IBM Security Guardium Database Activity Monitor 8.2 before p310, 9.x through 9.5 before p700, and 10.x through 10.1 before p100 allows remote authenticated use… |
CVE-2016-0920 | High | 7.8 | 2016-09-21 | Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) in EMC Avamar Server before 7.3.0-233 allow local users to obtain root access via a crafted parameter… |
CVE-2016-6367 | High | 7.8 | 2016-08-18 | Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain privileges via invalid… |
CVE-2016-2875 | High | 8.8 | 2016-08-08 | IBM Security QRadar SIEM 7.1.x and 7.2.x before 7.2.7 allows remote authenticated users to execute arbitrary OS commands as root via unspecified vectors. |
CVE-2016-5640 | Critical | 9.8 | 2016-08-03 | Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute ar… |
CVE-2016-4822 | High | 8.0 | 2016-06-25 | Corega CG-WLBARGL devices allow remote authenticated users to execute arbitrary commands via unspecified vectors. |
CVE-2016-1388 | Critical | 9.8 | 2016-06-03 | Cisco Prime Network Analysis Module (NAM) before 6.1(1) patch.6.1-2-final and 6.2.x before 6.2(1) and Prime Virtual Network Analysis Module (vNAM) before 6.1(1… |
CVE-2015-0857 | Critical | 9.8 | 2016-05-06 | Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar fil… |
CVE-2016-3081 | High | 8.1 | 2016-04-26 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitr… |
CVE-2016-2332 | High | 8.8 | 2016-04-25 | flu.cgi in the web interface on SysLINK SL-1000 Machine-to-Machine (M2M) Modular Gateway devices with firmware before 01A.8 allows remote authenticated users t… |
CVE-2016-2002 | Critical | 9.8 | 2016-04-20 | The validateAdminConfig handler in the Analytics Management Console in HPE Vertica 7.0.x before 7.0.2.12, 7.1.x before 7.1.2-12, and 7.2.x before 7.2.2-1 allow… |
CVE-2016-2056 | High | 8.8 | 2016-04-13 | xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_na… |
CVE-2015-5349 | High | 7.8 | 2016-04-11 | The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute… |
CVE-2016-2397 | Critical | 9.8 | 2016-02-17 | The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and… |
CVE-2016-2396 | Critical | 9.9 | 2016-02-17 | The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated us… |
CVE-2016-0861 | High | 8.8 | 2016-02-05 | General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands… |
CVE-2015-7541 | Critical | 10.0 | 2016-01-08 | The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to e… |
CVE-2015-5003 | High | 8.5 | 2016-01-03 | The portal in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary com… |
CVE-2015-6613 | | 2015-11-03 | Bluetooth in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to send commands to a debugging port, and consequently gain privileges, via… | |
CVE-2015-5011 | | 2015-10-26 | IBM WebSphere Message Broker 8 before 8.0.0.6 and Integration Bus 9 before 9.0.0.4 do not check authorization for MQSISTARTMSGFLOW and MQSISTOPMSGFLOW commands… | |
CVE-2015-4974 | | 2015-10-26 | IBM General Parallel File System (GPFS) 3.5.x before 3.5.0.27 and 4.1.x before 4.1.1.2 and Spectrum Scale 4.1.1.x before 4.1.1.2 allow local users to obtain ro… | |
CVE-2015-7839 | | 2015-10-15 | SolarWinds Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via a request to services/messagebroker/nonse… | |
CVE-2015-4930 | | 2015-10-04 | IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privilege… | |
CVE-2015-2011 | | 2015-10-04 | The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitr… | |
CVE-2015-5082 | | 2015-09-28 | Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 param… | |
CVE-2015-6547 | | 2015-09-20 | The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary… | |
CVE-2015-5274 | | 2015-09-18 | rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted request to the Broker. | |
CVE-2015-6912 | | 2015-09-11 | Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter… | |
CVE-2015-5190 | | 2015-09-03 | The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL. | |
CVE-2015-5474 | | 2015-08-13 | BitTorrent and uTorrent allow remote attackers to inject command line parameters and execute arbitrary commands via a crafted URL using the (1) bittorrent or (… | |
CVE-2015-5080 | | 2015-07-16 | The Management Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before 10.1.132.8, 10.5 before Build 56.15, and 1… | |
CVE-2015-1561 | | 2015-07-14 | The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreo… | |
CVE-2015-5453 | | 2015-07-08 | Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to… | |
CVE-2015-4525 | | 2015-07-04 | The log-gather implementation in the web administration interface in EMC Isilon OneFS 6.5.x.x through 7.1.1.x before 7.1.1.5 and 7.2.0.x before 7.2.0.2 allows… | |
CVE-2015-3716 | | 2015-07-03 | Spotlight in Apple OS X before 10.10.4 allows attackers to execute arbitrary commands via a crafted name of a photo file within the local photo library. | |
CVE-2015-3678 | | 2015-07-03 | AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified… | |
CVE-2015-1986 | | 2015-06-30 | The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different… | |
CVE-2015-1949 | | 2015-06-30 | The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands with SYSTEM privileges via unspecifie… | |
CVE-2015-1938 | | 2015-06-30 | The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different… | |
CVE-2015-4336 | | 2015-06-17 | cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames… | |
CVE-2015-3408 | | 2015-05-19 | Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when gener… | |
CVE-2015-0538 | | 2015-05-07 | ftagent.exe in EMC AutoStart 5.4.x and 5.5.x before 5.5.0.508 HF4 allows remote attackers to execute arbitrary commands via crafted packets. | |
CVE-2015-2846 | | 2015-04-13 | BitTorrent Sync allows remote attackers to execute arbitrary commands via a crafted btsync: link. | |
CVE-2015-0225 | | 2015-04-03 | The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to… | |
CVE-2015-1815 | | 2015-03-30 | The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell meta… | |
CVE-2015-2746 | | 2015-03-26 | The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON 7.8.3 and V-Series appliances before 7… | |
CVE-2015-2265 | | 2015-03-24 | The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive sh… | |
CVE-2015-0778 | | 2015-03-16 | osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file. | |
CVE-2015-2208 | | 2015-03-12 | The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object paramet… | |
CVE-2015-0934 | | 2015-03-04 | Common LaTeX Service Interface (CLSI) before 0.1.3, as used in ShareLaTeX before 0.1.3, allows remote authenticated users to execute arbitrary code via ` (back… | |
CVE-2014-9682 | | 2015-02-28 | The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to… | |
CVE-2015-2051 | High | 8.8 | 2015-02-23 | The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSetting… |
CVE-2014-8630 | | 2015-02-01 | Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitra… | |
CVE-2014-9622 | | 2015-01-21 | Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitra… | |
CVE-2014-7209 | | 2015-01-06 | run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters i… | |
CVE-2014-9277 | | 2015-01-04 | The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote… | |
CVE-2013-7418 | | 2015-01-02 | cgi-bin/iptablesgui.cgi in IPCop (aka IPCop Firewall) before 2.1.5 allows remote authenticated users to execute arbitrary code via shell metacharacters in the… | |
CVE-2014-3556 | | 2014-12-29 | The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly re… | |
CVE-2014-1905 | | 2014-12-29 | Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote a… | |
CVE-2013-4663 | | 2014-12-28 | git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the… | |
CVE-2014-9188 | | 2014-12-27 | Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecif… | |
CVE-2014-7208 | | 2014-12-19 | GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem label. | |
CVE-2014-7285 | | 2014-12-17 | The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting… | |
CVE-2014-6260 | | 2014-12-15 | Zenoss Core through 5 Beta 3 does not require a password for modifying the pager command string, which allows remote attackers to execute arbitrary commands or… | |
CVE-2014-8515 | | 2014-12-12 | The web interface in BitTorrent allows remote attackers to execute arbitrary commands by leveraging knowledge of the pairing values and a crafted request to po… | |
CVE-2013-2810 | | 2014-12-08 | Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier… | |
CVE-2014-8990 | | 2014-12-05 | default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename. |